FasterXML Jackson: Multiple denial-of-service vulnerabilities
FasterXML Jackson contains multiple vulnerabilities that can be exploited by an unauthenticated remote attacker to cause a denial-of-service condition on affected systems.
Triage facts
Revision 1- Applicability
- Jackson
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 12:14 UTC
- Source quality
- A3Likely
The BSI has reported that FasterXML Jackson contains multiple vulnerabilities that allow an unauthenticated remote attacker to trigger a denial-of-service (DoS) condition. Details regarding specific CVE identifiers or affected version ranges were not disclosed in the initial advisory.
Impact
Successful exploitation results in a denial-of-service condition, impacting the availability of applications utilizing the affected Jackson libraries.
Recommendation
- Inventory all applications in the environment that utilize the FasterXML Jackson library to identify potential exposure.
- Monitor vendor-specific security notifications from FasterXML for the release of patch information and specific affected versions.
- Implement standard resource monitoring for Java-based applications to detect abnormal spikes in CPU or memory usage that may indicate active DoS attempts.
Threat Hunt
Monitor application logs for repeated unexpected crashes or high CPU/memory exhaustion in services using Jackson
Data: Application logs (log4j, logback, etc.), System resource metrics (CPU, Memory)
Enrichment needed
- CVE identifiers and patched version numbers (CTI) Current advisory lacks specific versioning to determine patch applicability.
Mitigations
Identify and track Jackson library versions in use
Jackson DoS vulnerabilities